Virtual Private Cloud (VPC)

A virtual private cloud (VPC) is a logically isolated network within a public cloud provider's infrastructure. It gives a customer a private, configurable network space where they control IP address ranges, subnets, route tables, gateways, and security rules, much like running a private data-center network on shared cloud hardware.

How It Works

A VPC is defined within a region and spans its availability zones. The customer divides it into subnets, typically public subnets that can reach the internet through an internet gateway and private subnets that cannot, with outbound access via a NAT gateway. Routing tables direct traffic between subnets and to gateways. Security is enforced with stateful security groups attached to resources and stateless network access control lists at the subnet level. VPCs connect to other VPCs through peering or a transit gateway, and to on-premises networks through VPN or dedicated private links. Private endpoints let resources reach managed services without traversing the public internet.

Why It Matters

A VPC is the network foundation for secure cloud deployments. It lets teams segment workloads, isolate sensitive systems, control ingress and egress, and meet compliance requirements that demand network separation. Good VPC design, with tiered subnets and least-privilege rules, limits the blast radius of a compromise and keeps internal traffic off the public internet. Poorly configured VPCs are a common source of exposure, so network design deserves the same rigor as application security.

Related Terms

A VPC builds on infrastructure-as-a-service, lives within a region, and works with load balancers and security controls to protect workloads.